Platform Changelog

New kernel-level detection rule for the ETW provider hijacking technique used by Volt Typhoon to suppress EDR telemetry. Deployed automatically to all v4.1+ instances. See the threat research blog post for full technical details and IOCs.

New LLM-powered triage interface in the SOC Analyst module. Upload raw telemetry, SIEM exports, or paste log data — the AI proposes hypotheses, surfaces anomalies, and generates structured investigation notes. Available on Professional and Enterprise plans.

New dedicated DORA compliance framework covering all 5 pillars: ICT risk management, incident classification, TLPT (threat-led pen testing), third-party risk, and information sharing. Automated evidence collection and regulatory notification timeline tracking included.

Expanded the external attack surface scanner to detect dangling DNS records and misconfigured cloud storage that could be hijacked by attackers. Covers 34 cloud provider patterns including AWS S3, Azure Blob, GitHub Pages, and Fastly.

The ransomware playbook trigger now automatically classifies the detected variant (LockBit, ALPHV, Cl0p, etc.) using the encrypted file extension and ransom note signature, and pre-populates the incident with variant-specific IOCs, known C2 infrastructure, and negotiation history.

Fixed a timeout occurring when generating PDF reports for compliance frameworks with more than 800 evidence items. Report generation now streams incrementally and supports evidence sets up to 10,000 items without timeout.

Fixed a rounding error in the timeline engine that caused events with sub-50ms timestamps to be merged with the previous event, resulting in missing steps in fast lateral movement sequences.

Complete rewrite of the core detection engine using a transformer-based neural network trained on 2.4 billion threat events. Mean time to detect (MTTD) improved by 68% vs v3.x. False positive rate reduced from 0.8% to 0.09%. Backward compatible with all existing detection rules.

Single-pane visibility across all three major cloud providers. Auto-discovers compute instances, storage buckets, serverless functions, IAM roles, and network exposure. Risk-scores every asset and surfaces the top 10 highest-priority remediations daily.

Breach Response Playbooks now auto-generates pre-filled regulatory notification drafts for GDPR (72h DPA notice), NIS2 (24h early warning + 72h report), and SEC Form 8-K, with deadline countdown timers and a review workflow for your legal team.

All /api/v1/* endpoints have been removed as announced in v3.8. Customers must migrate to /api/v2/* endpoints. The migration guide is available in the API documentation. The v1 → v2 compatibility shim remains available as an opt-in setting until v4.5.

Custom detection rules using the v1 schema (YAML with match field) must be migrated to the v2 schema (detection block with Sigma-compatible syntax). Auto-migration tool available at Settings → Detection Rules → Migrate Legacy Rules. Deadline: v4.5 (estimated July 2026).

Mutual TLS is now enforced (was previously optional) for all endpoint agent connections. Existing agents will auto-rotate certificates on next check-in. Agents older than v3.2 will need manual certificate provisioning — see the upgrade guide.

Complete frontend rebuild using incremental data loading. The main SOC dashboard now loads the critical path (alerts, active incidents, top threats) within 800ms on a 50Mbps connection, down from 2.8s in v3.x. Full data loads asynchronously in the background.

Fixed a critical authentication bypass vulnerability in the SAML 2.0 SSO integration that could allow an unauthenticated attacker to log in as any user on affected Enterprise instances using SAML. All Enterprise customers were notified directly. CVSS: 9.8. Patch was deployed automatically to hosted instances within 4 hours of discovery.

Red and blue team operators can now share the same simulation session with role-based views. Red team sees the attack execution timeline; blue team sees detection coverage gaps in real time. Requires Professional or Enterprise plan.

Updated all ISO 27001 controls to the 2022 revision. 11 new controls added, 58 controls reorganised into the new Annex A structure. Existing ISO 27001 compliance postures will show a one-time re-assessment prompt.

Fixed a misconfiguration in the exposure scoring model that was incorrectly flagging internal RFC-1918 IP ranges as externally exposed when the scanner encountered split-horizon DNS configurations. Added explicit RFC-1918 exclusion to the scoring pipeline.

Native two-way integrations with the three most common enterprise SIEMs. SentinelPRO IA can now both ingest events from your SIEM and push enriched detections back with full context, eliminating manual copy-paste workflows for tier-1 analysts.

The v2 REST API is now generally available and stable. Key improvements over v1: consistent pagination, webhook support for all event types, OpenAPI 3.1 spec auto-generated from code, rate limit headers on every response, and a new streaming endpoint for real-time event feeds. API v1 deprecated — removal in v4.0.

Added 140 new atomic technique simulations across 18 tactic categories, bringing the total library to 847 simulations. New additions focus on cloud-native attack paths (Lambda abuse, IMDS credential theft, storage exfiltration) and AI system attacks.

All /api/v1/* endpoints are deprecated as of this release and will be removed in v4.0 (est. January 2026). A compatibility shim is available as an opt-in setting. The v1 → v2 migration guide is available in the API documentation. Deprecation warnings will appear in API responses from v1 endpoints.

Starter plan customers now get access to Threat Engine, Attack Surface Monitor, and Compliance Automation Suite — up from just Threat Engine. Pricing unchanged at $297/mo. Existing Starter customers see new modules unlocked in their dashboard immediately.

Analysts can now configure different alert severity thresholds for different asset groups (e.g., lower threshold for crown-jewel servers, higher threshold for dev environments). Reduces noise without losing coverage on critical assets.

Fixed a memory leak in the Windows endpoint agent where the event buffer was not being flushed correctly for processes running longer than 72 hours, causing gradual memory growth of ~4MB/hr. Agent auto-updates are enabled by default and will deploy this fix silently.

Introducing the 5th SentinelPRO IA module: automated incident response playbooks for ransomware, data exfiltration, insider threat, and supply chain compromise. 48 pre-built playbooks, fully customisable, with one-click isolation and forensic evidence preservation built in.

The 6th and final core module: automated MITRE ATT&CK-aligned simulation drills that test your defences without real-world risk. Schedule continuous drills, measure detection coverage percentage, and get a prioritised remediation backlog based on missed detections.

TLS 1.0 and 1.2 connections are no longer accepted by the SentinelPRO IA platform API and dashboard. TLS 1.3 is required. Enterprise customers with legacy proxy infrastructure should review their TLS termination configuration before upgrading.

Launched the 4th module: a full SOC analyst workbench including case management, timeline reconstruction, analyst collaboration, and SOAR integration for automated playbook execution. Replaced the previous basic alert triage interface entirely.

v2.0 introduced the multi-tenant architecture that powers the current platform, with complete tenant isolation, per-tenant retention policies, and the licensing system that enables per-seat and per-module billing. This is the foundation version for all current SentinelPRO IA installations.